Who may be interested

Most of all I’ve written this article for those who have been always interested in the way the different things work. It is for those developers who usually create their applications in high-level languages such as C, C++ or Java, but faced with the necessity to develop something at low-level. We will consider low-level programming on the example of working at system loading.

We will describe what is going after you turn on a computer; how the system is loading. As the practical example we will consider how you can develop your own boot loader which is actually the first point of the system booting process.

What is Boot Loader

Boot loader is a program situated at the first sector of the hard drive; and it is the sector where the boot starts from. BIOS automatically reads all content of the first sector to the memory just after the power is turned on, and jump to it. The first sector is also called Master Boot Record. Actually it is not obligatory for the first sector of the hard drive to boot something. This name has been formed historically because developers used to boot their operating systems with such mechanism.

Be ready to go deeper

In this section I will tell about knowledge and tools you need to develop your own boot loader and also remind some useful information about system boot.

So what language you should know to develop Boot Loader

On the first stage on the computer work the control of hardware is performed mainly by means of BIOS functions known as interrupts. The implementation of interrupts is given only in Assembler – so it is great if you know it at least a little bit. But it’s not the necessary condition. Why? We will use the technology of “mixed code” where it is possible to combine high-level constructions with low-level commands. It makes our task a little simpler.

In this article the main development languages is C++. But if you have brilliant knowledge of C then it will be easy to learn required C++ elements. In general even the C knowledge will be enough but then you will have to modify the source code of the examples that I will descried here.

If you know Java or C# well unfortunately it won’t help for our task. The matter is that the code of Java and C# languages that is produced after compilation is intermediate. The special virtual machine is used to process it (Java Machine for Java, and .NET for C#) which transform intermediate code into processor instructions. After that transformation it can be executed. Such architecture makes it impossible to use mixed code technology – and we are going to use it to make our life easier, so Java and C# don’t work here.

So to develop the simple boot loader you need to know C or C++ and also it would be good if you know something about Assembler – language into which all high-level code is transformed it the end.

What compiler you need

To use mixed code technology you need at least two compilers: for Assembler and C/C++, and also the linker to join object files (.obj) into the one executable.

Now let’s talk about some special moments. There are two modes of processor functioning: real mode and protected mode. Real mode is 16-bit and has some limitations. Protected mode is 32-bit and is fully used in OS work. When it starts processor works in 16-bit mode. So to build the program and obtain executable file you will need the compiler and linker of Assembler for 16-bit mode. For C/C++ you will need only the compiler that can create object files for 16-bit mode.

The modern compilers are made for 32-bit applications only so we won’t able to use them.

I tried a number of free and commercial compilers for 16-bit mode and choose Microsoft product. Compiler along with the linker for Assembler, C, C++ are included into the Microsoft Visual Studio 1.52 package and also can be downloaded from the official site of the company. Some details about compilers we need are given below.

In order to solve our task we should recall how the system is booting.

Let’s consider briefly how the system components are interacting when the system is booting (see Fig.1).

Fig.1 – “How it boots”

After the control has been passed to the address 0000:7C00, Master Boot Record (MBR) starts its work and triggers the Operating System boot. You can learn more about MBR structure for example here.

Let’s code

In the next sections we will be directly occupied with the low-level programming – we will develop our own boot loader.

Program architecture

Boot loader that we are developing is for the training only. Its tasks are just the following:

Correct loading to the memory by 0000:7C00 address.

Calling the BootMain function that is developed in the high-level language.

Show “”Hello, world…”, from low-level” message on the display.

Program architecture is described on the Fig.2 that is followed by the text description.

Fig.2. – Program architecture description

The first entity is StartPoint that is developed purely in Assembler as far as high-level languages don’t have the necessary instructions. It tells compiler what memory model should be used, and what address the loading to the RAM should be performed by after the reading from the disk. It also corrects processor registers and passes control to the BootMain that is written in high-level language.

Next entity– BootMain – is an analogue of main that is in its turn the main function where all program functioning is concentrated.

CDisplay and CString classes take care of functional part of the program and show message on the screen. As you can see from the Fig.2 CDisplay class uses CStringclass in its work.

Development environment

Here I use the standard development environment Microsoft Visual Studio 2005 or 2008. You can use any other tools but I made sure that these two with some settings made the compiling and work easy and handy.

First we should create the project of Makefile Project type where the main work will be performed (see Fig.3).

File->New\Project->General\Makefile Project

Fig.3 – Create the project of Makefile type

BIOS interrupts and screen clearing

To show our message on the screen we should clear it first. We will use special BIOS interrupt for this purpose.

BIOS proposes a number of interrupts for the work with computer hardware such as video adapter, keyboard, disk system. Each interrupt has the following structure:

int [number_of_interrupt];

where number_of_interrupt is the number of interrupt

Each interrupt has the certain number of parameters that should be set before calling it. The ah processor register is always responsible for the number of function for the current interrupt, and the other registers are usually used for the other parameters of the current operation. Let’s see how the work of int 10h interrupt is performed in Assembler. We will use the 00 function that changes the video mode and clears screen:

«Mixed code»

Compiler for C++ supports the inbuilt Assembler i.e. when writing code in igh-level language you can use also low level language. Assembler Instructions that are used in the high level code are also called asm insertions. They consist of the key word __asm and the block of the Assembler instructions in braces:

Creation of COM file

Now when the code is developed we need to transform it to the file for the 16-bit OS. Such files are .com files. We can start each of compilers (for Assembler and C, C++) from the command line, transmit necessary parameters to them and obtain several object files as the result. Next we start linker to transform all .obj files to the one executable file with .com extension. It is working way but it’s not very easy.

Let’s automate the process. In order to do it we create .bat file and put commands with necessary parameters there. Fig.4 represents the full process of application assembling.

Fig.4 – Process of program compilation Build.bat

Let’s put compilers and linker to the project directory. In the same directory we create .bat file and fill it accordingly to the example (you can use any directory name instead of VC152 where compilers and linker are situated):

As the final stage in this section we will describe the way how to turn Microsoft Visual Studio 2005, 2008 into the development environment with any compiler support. Go to the Project Properties: Project->Properties->Configuration Properties\General->Configuration Type.

Configuration Properties tab includes three items: General, Debugging, NMake. Go to NMake and set the path to the build.bat in the Build Command Line and Rebuild Command Line fields – Fig.5.
Fig.5 –NMake project settings

If everything is correct then you can compile in the common way pressing F7 or Ctrl + F7. At that all attendant information will be shown in the Output window. The main advantage here is not only the assembly automation but also navigation thru the code errors if they happen.

Testing and Demonstration

This section will tell how to see the created boot loader in action, perform testing and debug.

How to test boot loader

You can test boot loader on the real hardware or using specially designed for such purposes virtual machine – VmWare. Testing on the real hardware gives you more confidence that it works while testing on the virtual machine makes you confident that it just can work. Surely we can say that VmWare is great method for testing and debug. We will consider both methods.

First of all we need a tool to write our boot loader to the virtual or physical disk. As far as I know there a number of free and commercial, console and GUI applications. I used Disk Explorer for NTFS 3.66 (version for FAT that is named Disk Explorer for FAT) for work in Windows and Norton Disk Editor 2002 for work in MS-DOS.

I will describe only Disk Explorer for NTFS 3.66 because it is the simplest method and suits our purposes the most.

Testing with the virtual machine VmWare

Creation of the virtual machine

We will need VmWare program version 5.0, 6.0 or higher. To test boot loader we will create the new virtual machine with minimal disk size for example 1 Gb. We format it for NTFS file system. Now we need to map the formatted hard drive to VmWare as the virtual drive. To do it:

File->Map or Disconnect Virtual Disks...

After that the window appears. There you should click Map button. In the next appeared window you should set the path to the disk. Now you can also chose the letter for the disk- see Fig.6.
Fig.6 – Parameters of virtual disk mapping

Don’t forget to uncheck the “Open file in read-only mode (recommended)” checkbox. When checked it indicates that the disk should be opened in read-only mode and prevent all recording attempts to avoid data corruption.

After that we can work with the disk of virtual machine as with the usual Windows logical disk. Now we should use Disk Explorer for NTFS 3.66 and record boot loader by the physical offset 0.

Working with Disk Explorer for NTFS

After program starts we go to our disk (File->Drive). In the window appeared we go to the Logical Drives section and chose disk with the specified letter (in my case it is Z) – see Fig.7.
Fig.7 – choosing disk in Disk Explorer for NTFS

Now we use menu item View and As Hex command. It the appeared window we can see the information on the disk represented in the 16-bit view, divided by sectors and offsets. There are only 0s as soon as the disk is empty at the moment. You can see the first sector on the Fig.8.

Fig.8 – Sector 1 of the disk

Now we should write our boot loader program to this first sector. We set the marker to position 00 as it is shown on the Fig.8. To copy boot loader we use Edit menu item, Paste from file command. In the opened window we specify the path to the file and click Open. After that the content of the first sector should change and look like it’s shown on the Fig.9 – if you haven’t changed anything in the example code, of course.

You should also write signature 55AAh by the 1FE offset from the sector beginning. If you don’t do it BIOS will check the last two bytes, won’t find the mentioned signature and will consider this sector as not the boot one and won’t read it to the memory.

To apply writing we go to Tools->Options. Window will appear; we go to the Mode item and chose the method of writing - Virtual Write and click Write button – Fig.10.

Fig.10 – Choosing writing method in Disk Explorer for NTFS

A great number of routine actions are finished at last and now you can see what we have been developing from the very beginning of this article. Let’s return to the VwWare to disconnect the virtual disk (File->Map or Disconnect Virtual Disks… and click Disconnect).

Let’s execute the virtual machine. We can see now how from the some depth, from the kingdom of machine codes and electrics the familiar string appears ““Hello, world…”, from low-level…” – see Fig.11.

Fig.11 – “Hello world…”

Testing on the real hardware

Testing on the real hardware is almost the same as on the virtual machine except the fact that if something doesn’t work you will need much more time to repair it than to create the new virtual machine. To test boot loader without the threat of existent data corruption (everything can happen), I propose to use flash drive, but first you should reboot your PC, enter BIOS and check if it supports boot from the flash drive. If it does than everything is ok. If it does not than you have to limit your testing to virtual machine test only.

The writing of boot loader to the flash disk in Disk Explorer for NTFS 3.66 is the same to the process for virtual machine. You just should choose the hard drive itself instead of its logical section to perform writing by the correct offset – see Fig.12.

Fig.12 – Choosing physical disk as the device

Debug

If something went wrong – and it usually happens – you need some tools to debug your boot loader. I should say at once that it is very complicated, tiring and time-eating process. You will have to grasp in the Assembler machine codes – so good knowledge of this language is required. Any way I give a list of tools for this purpose:

TD (Turbo Debugger) – great debugger for 16-bit real mode by Borland.

CodeView – good debugger for 16-bit mode by Microsoft.

D86 – good debugger for 16-bit real mode developed by Eric Isaacson – honored veteran of development for Intel processor in Assembler.

Bocsh – program-emulator of virtual machine that includes debugger of machine commands.

“Assembly Language for Intel-Based Computers” by Kip R. Irvineis the great book that gives good knowledge of inner structure of the computer and development in Assembler. You ca also find information about installation, configuration and work with the MASM 6.15 compiler.

Conclusion

In this article we have considered what is boot loader, how BIOS works, and how system components interact when system boots. Practical part gave the information about how to develop your own simple boot loader. We demonstrated the mixed code technology and process of automation of assembly with Microsoft Visual Studio 2005, 2008.

Of course it is just a small piece comparing with the huge theme of low-level programming, but if you get interested of this article – it’s great.

Comments and Discussions

Great article! I'm interested in republishing a translation (in Italian) of your article on my website, but I see that the CPOL requires that I obtain your permission before doing so. May I republish your article?Thanks.

Unless my memory fails me, the far is a remnant from days of old, before protected-mode operating systems were ubiquitous. Back then, x86 memory was accessible only in 64kb chunks, known as segments. Use of the far keyword indicates that the pointer to something contains not just an offset within a segment, but also the segment itself - the pointed-to address is 'far' away.

Nowadays, all of the memory that a system has is mapped into a 'flat' memory space. That has the effect of removing the need for a segment address. One simply has to supply a 32 or 64 bit offset. Having memory available like this is an absolute godsend compared to segmented memory. Can you even begin to imagine how painful it was trying to create an array whose size was larger than 65536 bytes? (Dont't try - it was awfully painful!) Images, Sound, Videos - more painful than a stint in an iron maiden.

Then, EMM386 and himem.sys came along and things weren't so bad. Still awful, but far more manageable. While I miss the days of complete free reign over the hardware that you had in real-mode, the advantages that protected mode bring are a real treat.

"When I was 5 years old, my mother always told me that happiness was the key to life. When I went to school, they asked me what I wanted to be when I grew up. I wrote down 'happy'. They told me I didn't understand the assignment, and I told them they didn't understand life." - John Lennon

From the level of complexity to the depth of explanation this is one of those college level treatments that makes the rest of everything that much easier. Incredible example and very well thought out delivery with lateral support with hexadecimal treatments and illustrations as well as many others.

Anyone unfamiliar or new to the topics of assembler, boot loaders and rational HLL systems design should take notice of this example's message and follow. This page is packed and flows uninterrupted -- definitely a text based workshop going on here -- stars and thumbs way up!

Generally speaking, I'm the type of guy who likes getting his feet knee deep into low level stuff. It feels good to get away from all that abstraction every once in a while. Thanks for writing this article! I was able to write a small utility OS for quickly checking the status of hardware components as which also included a flexible modification system for adding further extensions. One of the extensions I added was a module for cracking windows LANMAN and NT passwords. Working so close to the metal can give a pretty big speed boost for performance intensive routines such as these!All-in-All, it's mostly just a novelty system but I'm still proud of it.

I wrote my own code from the ground up, but you still taught the necessary concepts extremely well! I'm looking forward to more articles! I especially liked the included resource links and information on testing code in a virtual environment.

Disclaimer: Regarding my cracking extension, I'm not a Cracker and I don't consider myself to be a hacker (black-hat or white-hat). I just like to write cool programs!

You can't use "events" per se within the boot loader as it is a high level concept. You can, however, preform a simple check using assembly instructions or by calling a sub-routine which can be coded in C++/C (simple function). The code to read and check for a character would be (in NASM):(This assumes you are in the correct/desired video mode)

charloop: ;-- Label
movah,08;-- sub-function under the DOS_INTERRUPT. Reads one character, but does not display it.
int21h;-- Call the DOS_INTERRUPT (Takes the value from the ah register and sends it to the
;BIOS in order to call the correct sub-function.)
cmpal,030;-- Compares the keyboard input with the desired key (030 is hex for an ascii "0".)
jnz charloop ;-- If not zero ( (al - 030) != 0 ) then re-loop until user enters desired key.
;Otherwise it will fall through to the next part of the code. If you don't care
;if the user enters the right character replace with the "jz" instruction
;and add a label after it directing it to the correct routine/code section.

F.Y.I. In-case you didn't know, the "cmp" instruction sets the zero flag if two values are equivalent (does a simple subtraction). Then the "jnz" conditional instruction takes that flag and determines whether or not to jump. Literally "jump if not zero". The instruction "jz" is the exact opposite.

I'm only 16 so if I botched anything please feel free to correct me. I'm here to learn too.